1 was true, but is increasingly less true. You can purchase things on the web using Apple Pay, at least on some sites, which also produces one time use tokens.

A significant number of sites also use stripe, which produces merchant specific revocable tokens. This doesn’t eliminate merchant fraud risk, but it does vastly reduce the risk of your CC details being leaked.